sgl-project/sglang · error · ValueError

SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. Pl

Error message

SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. Please check the --ssl-ca-certs path.

What it means

SGLang validates SSL-related server arguments before startup. This error is raised when --ssl-ca-certs points to a path that does not exist on disk, meaning the CA bundle used to verify client/server certificates cannot be loaded.

Source

Thrown at python/sglang/srt/server_args.py:4338

                    "--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile."
                )
            if cfg.ssl_keyfile_password:
                raise ValueError(
                    "--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile."
                )
        # Validate files exist early to avoid late failures after model loading.
        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):
            raise ValueError(
                f"SSL key file not found: '{cfg.ssl_keyfile}'. "
                f"Please check the --ssl-keyfile path."
            )
        if cfg.ssl_certfile and not os.path.isfile(cfg.ssl_certfile):
            raise ValueError(
                f"SSL certificate file not found: '{cfg.ssl_certfile}'. "
                f"Please check the --ssl-certfile path."
            )
        if cfg.ssl_ca_certs and not os.path.isfile(cfg.ssl_ca_certs):
            raise ValueError(
                f"SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. "
                f"Please check the --ssl-ca-certs path."
            )
        if cfg.enable_ssl_refresh and not (cfg.ssl_certfile and cfg.ssl_keyfile):
            raise ValueError(
                "--enable-ssl-refresh requires --ssl-certfile and --ssl-keyfile "
                "to be specified."
            )

        if cfg.enable_http2:
            if not 0 < cfg.http2_max_concurrent_streams < 2**32:
                raise ValueError(
                    "--http2-max-concurrent-streams must be between 1 and "
                    "4294967295."
                )

            try:
                import granian  # noqa: F401

View on GitHub (pinned to 0132848349)

Solutions

Verify the file exists: ls -l <path> on the host/container where the server runs
Use an absolute path for --ssl-ca-certs
In containers, confirm the secret/volume is mounted and the path in args matches the mount point
If CA verification is not needed, drop --ssl-ca-certs entirely

Example fix

# before
python -m sglang.launch_server --ssl-ca-certs certs/ca.pem
# after
python -m sglang.launch_server --ssl-ca-certs /etc/sglang/certs/ca.pem

Defensive patterns

Strategy: validation

Validate before calling

import os
for p in [args.ssl_ca_certs, args.ssl_certfile, args.ssl_keyfile]:
    if p and not os.path.isfile(p):
        raise SystemExit(f"missing TLS file: {p}")

Prevention

Always use absolute paths for TLS material
Add preflight checks (os.path.isfile) in launch scripts
Mount certs at a fixed well-known path in containers

When it happens

Trigger: Launching the server with --ssl-ca-certs /path/to/ca.pem where the file does not exist (typo, missing mount, wrong container path). Validation happens in _handle_ssl_validation during the server_args resolution pipeline, before any model loading.

Common situations: Docker/Kubernetes volumes not mounted at the expected path; typo in the cert path; cert file present in dev but missing in the deployment image; relative path resolved against a different working directory.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of sgl-project/sglang@0132848349 (2026-08-28). Data as JSON: /api/errors/4cdb19c8a90bae3c. Report an issue: GitHub.